2026-07-21 归档

今日共收录 1301 条安全情报，包含 465 个 CVE，462 篇安全通告，以及 91 篇研究论文。

漏洞预警2026-07-20 发布INFO

HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If `H5Iget_name` is invoked on a group id with `0` for the size parameter...

CVE-2026-26199

HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If `H5Iget_name`

历史摘要 · 未重新核验 · NVD

#cve #cwe-124

漏洞预警2026-07-20 发布INFO

HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If a file is corrupted such that an array datatype's size, the number of ...

CVE-2026-26197

HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If a file is cor

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-07-20 发布INFO

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.

CVE-2026-26081

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise

历史摘要 · 未重新核验 · NVD

#cve #cwe-130

漏洞预警2026-07-20 发布INFO

HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected.

CVE-2026-26080

HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAPro

历史摘要 · 未重新核验 · NVD

#cve #cwe-252

漏洞预警2026-07-20 发布INFO

Parsec is a cloud-based application for simple and cryptographically secure file sharing. The application does not sanitize the workspace name, creating a vulnerability if that ...

CVE-2026-25039

Parsec is a cloud-based application for simple and cryptographically secure file sharing. The application does not sanit

历史摘要 · 未重新核验 · NVD

#cve #cwe-40

漏洞预警2026-07-20 发布INFO

HCL Commerce contains an privilege escalation vulnerability that could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative o...

CVE-2026-21824

HCL Commerce contains an privilege escalation vulnerability that could allow denial of service, disclosure of user perso

历史摘要 · 未重新核验 · NVD

#cve #cwe-266

漏洞预警2026-07-20 发布INFO

Client-Side Enforcement of Server-Side Security vulnerability in Gobito Informatics Technologies Engineering Industry and Trade Ltd. Co. Corporate Training Management System all...

CVE-2026-13724

Client-Side Enforcement of Server-Side Security vulnerability in Gobito Informatics Technologies Engineering Industry an

历史摘要 · 未重新核验 · NVD

#cve #cwe-602

漏洞预警2026-07-20 发布INFO

ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the mod_sftp module's SCP size-record parser that allows authenticated low-privilege atta...

CVE-2026-63091

ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the mod_sftp module's SCP size-r

历史摘要 · 未重新核验 · NVD

#cve #cwe-126 #cwe-190

漏洞预警2026-07-20 发布INFO

ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp module that allows authenticated low-privilege attackers to achieve arbit...

CVE-2026-63090

ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp module that allo

历史摘要 · 未重新核验 · NVD

#cve #cwe-122

漏洞预警2026-07-20 发布INFO

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class ...

CVE-2026-63071

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements

历史摘要 · 未重新核验 · NVD

#cve #cwe-653

漏洞预警2026-07-20 发布INFO

Low-privileged authenticated Server-Side Request Forgery (SSRF) vulnerability in Apache Syncope via Connectors and Resources check. This issue affects Apache Syncope: from 3...

CVE-2026-62418

Low-privileged authenticated Server-Side Request Forgery (SSRF) vulnerability in Apache Syncope via Connectors and Reso

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-07-20 发布INFO

Improper Privilege Management vulnerability in Apache Syncope. When: * the all-Java user workflow adapter is configured, or * the Flowable user workflow adapter is configured,...

CVE-2026-62183

Improper Privilege Management vulnerability in Apache Syncope. When: * the all-Java user workflow adapter is configure

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-07-20 发布INFO

Stored Cross-site Scripting (CWE-79) in the client-side report rendering functions (renderPreview, renderEditor, renderAuditData in js/app.js) in maalfer Pentestify before 1.1.0...

CVE-2026-59238

Stored Cross-site Scripting (CWE-79) in the client-side report rendering functions (renderPreview, renderEditor, renderA

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-20 发布INFO

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve ex...

CVE-2026-57308

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. A

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-07-20 发布INFO

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the `subtitlesHandler` endpoint (`GET /api/media/subtitles`) accepts two user-co...

CVE-2026-54910

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the `subtitlesHandler`

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-23

漏洞预警2026-07-20 发布INFO

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.3.2-beta, the `/api/auth/login` authentication endpoint does not execute in constant time....

CVE-2026-54685

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.3.2-beta, the `/api/auth/login` a

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

漏洞预警2026-07-20 发布INFO

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve remote code execution through the connecto...

CVE-2026-53421

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlemen

历史摘要 · 未重新核验 · NVD

#cve #cwe-653

漏洞预警2026-07-20 发布INFO

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the RE...

CVE-2026-53405

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements

历史摘要 · 未重新核验 · NVD

#cve #cwe-653

漏洞预警2026-07-20 发布INFO

Directory Traversal vulnerability in Menyoo 2.0 Versions before commit 729aa48: fixed in commit 729aa48 allows a local attacker to execute arbitrary code via the Spooner file ma...

CVE-2026-52349

Directory Traversal vulnerability in Menyoo 2.0 Versions before commit 729aa48: fixed in commit 729aa48 allows a local a

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-07-20 发布INFO

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2026-46409. Reason: This record is a reservation duplicate of CVE-2026-46409. Notes: All CVE users should reference ...

CVE-2026-51386

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2026-46409. Reason: This record is a reservation duplicate

历史摘要 · 未重新核验 · NVD

#cve